Would Pausing AI Reduce Cyber Risk? The Sanders Proposal
Bernie Sanders wants to pause AI and outlaw superintelligence. Here is what a pause would and would not fix for cyber risk, open-weight models and AI agents.
Would pausing AI development reduce cyber risk?
Probably only in part. A pause on frontier training could slow the next jump in capability, but it would not recall open-weight models that are already downloaded, and it would not remove the attack tooling already in use. Sen. Bernie Sanders has called for a pause and a ban on anything like superintelligence. The cyber threat described in current reporting comes largely from models and agents that exist today.
TL;DR
- Sanders has proposed pausing AI and outlawing superintelligence, and per a creator's summary the proposal also discusses jailing researchers.
- Open-weight models cannot be recalled or switched off once downloaded, so a pause on new training does not touch the copies already out there.
- A Microsoft investigation reportedly described a China-aligned actor using several models, some of them open source, to go from initial targeting to cloud admin access in about three hours.
- Banks are reportedly detecting unauthorized third-party AI agents in customer accounts, and Amazon blocks users' own AI agents from shopping.
- Sam Altman said in a Stanford GSB interview that not all bugs can be patched, which argues for changing how defense works, not just slowing offense.
- Neither "full steam ahead" nor "freeze everything" is a complete answer. The hard work is in defense, agent identity and access controls.
What is Sanders actually proposing?
According to the source video, Sanders responded to an article about AI agents possibly acting financially on behalf of users. His answer was to pause AI now and outlaw anything like superintelligence. The same summary says the proposal discusses jailing researchers. I could not verify the proposal text beyond that description, so treat the details as secondhand.
The creator was careful to say Sanders is not a cartoon villain here. He reportedly met with AI researchers and did his homework. The criticism is narrower: AI is turning into another tribal political topic, where one side promises to save you from AI and the other is painted as wanting everyone to die. Both framings flatten a harder problem.
Why are people talking about a pause now?
Because the cyber news has been bad. The source describes a wave of incidents it calls "Black October." Details reported there:
- Quest Diagnostics confirmed that patient personal and health data was compromised in a breach.
- A security researcher said a honeypot server was hit 14,000 times in six hours, with no human traffic, and called it unlike anything in a decade of experience. This is one person's account, not an audited figure.
- A major PHP vulnerability was disclosed on October 21, and the NSA reportedly advised that anyone who could not fix it should shut down.
- Cloudflare reported exploitation attempts beginning several days before the official announcement.
- Jason Clinton at Anthropic said things would get a lot worse, after warning months earlier that a "vulnerability tsunami" was coming.
The pattern matters more than any single incident. Attackers were moving before defenders knew there was a problem.
Why can't open-weight models be paused or guardrailed?
An open-weight model is a file. Once someone downloads it, the developer cannot revoke it, monitor how it is used, or patch its behavior remotely. A hosted model can be rate-limited, filtered and shut off by its provider. A local copy cannot.
Guardrails are the second problem. Safety training on a released model sits in the weights, and anyone with the weights can fine-tune them. Techniques such as "abliteration" (removing the internal direction that drives refusals) and ordinary fine-tuning are well-known ways to strip refusal behavior from open models. The source material does not detail these techniques, but this is established practice in the open-model community. The result is a capable model with no refusal layer, running on hardware the attacker controls.
A pause on new frontier training would not touch any of this. Every released checkpoint stays available, and every derivative of it too.
How are attackers using models today?
The source cites a Microsoft investigation of a threat actor it calls Storm-0940 (written "Storm0940" in the transcript), described as China-aligned and running a large-scale, nation-state campaign. Per that account:
| Detail | What was reported |
|---|---|
| Actor | China-aligned, nation-state scale |
| Tooling | Several models, some open source, some Chinese open-source |
| Speed | About 3 hours from initial targeting to cloud access with powerful admin privileges |
| Success rate | Microsoft noted most attempts were not successful |
The low success rate is weak comfort. The creator's point is that spotting a couple of rogue agents does not mean you found them all. Seeing two ants usually means there are more in the walls. Automated attacks are cheap to run at volume, so a low hit rate can still produce many breaches.
What is happening with AI agents in bank accounts?
The same reporting says major US banks are detecting unauthorized third-party AI agents inside customer accounts. Amazon, separately, no longer lets users' own AI agents shop on its site.
Most of that agent activity is probably harmless. Users hand tasks to assistants for good reasons, and many people want agents that can handle finances or appointments. The trouble is that a bank cannot easily tell a benign agent acting for a customer from a hostile one, or from an agent that has been manipulated.
Manipulation is not hypothetical. The source recalls an earlier vulnerability, since patched as far as the creator knew, where a chat assistant could be steered into clicking links that spelled out private data one character at a time, slipping past safeguards. It also mentions a developer who found a coding agent exposing personal data in HTTP headers when it fetched a site with curl. Agents that act on the web leak in ways that ordinary software does not.
Would a pause fix any of this?
A pause would help at the margin. It could buy time and reduce the odds of a sharp capability jump landing before defenses adapt. It would not do the following:
- Remove open-weight models already distributed.
- Stop actors outside the jurisdiction that passes the law, including nation-state groups.
- Fix existing vulnerabilities, such as the PHP issue, or the unpatched software the internet runs on.
- Solve agent identity, meaning how a bank or retailer verifies who or what is acting.
There is also the enforcement problem. Laws that bind labs in one country do not bind a downloaded file or a foreign intelligence service. A ban might mostly constrain the actors who were already trying to follow rules.
Is "patch everything" a real alternative?
Altman's comment suggests it is not. In the Stanford interview he said that patching all the bugs, including updating all the PHP, simply will not work. His broader claim, as summarized, is that governments and business leaders are not taking the approaching danger seriously enough.
The reasoning is about trend lines. If a model finds 10 vulnerabilities and organizations patch those 10 and return to business as usual, they miss that the next model may find bugs today's cannot see. The source mentions models named Mythos and Astra as examples of capabilities that did not exist at the start of the year. Defense that treats each discovery as a one-time cleanup is always behind.
That argues for a different posture: assume new bugs will keep surfacing, shorten patch cycles, limit blast radius, and use AI on the defensive side at the same pace attackers use it on offense.
What would a workable response include?
Neither side of the political fight offers this whole list, but the evidence points to it:
- Agent identity and authorization. Banks and retailers need ways to register, scope and revoke agents acting for a user.
- Faster disclosure and patching. Exploitation began before public announcement, so coordination before disclosure matters.
- Least-privilege defaults. The three-hour path to admin access shows how much damage excess privilege allows.
- Realistic policy on open weights. Rules aimed at future releases are possible. Rules aimed at existing copies are not.
Frequently Asked Questions
Does Bernie Sanders want to ban all AI?
Based on the source summary, no. The proposal is described as a pause on AI development and an outlawing of anything like superintelligence, with some discussion of jailing researchers. The exact text was not in the source material, so check the primary document before quoting it.
Can open-source AI models be restricted after release?
Not in any practical way. Once weights are downloaded, the developer cannot revoke or monitor them. Safety behavior can also be removed by fine-tuning or by techniques such as abliteration, which is why guardrails on open-weight models are weak against a determined user.
Why are banks and Amazon blocking AI agents?
Both face the same verification problem. They cannot easily distinguish a user's legitimate assistant from an unauthorized or compromised agent. Banks have reportedly detected unauthorized third-party agents in customer accounts, and Amazon no longer lets users' own agents shop on its site.
If a pause would not stop attacks, is it pointless?
Not necessarily. It could slow the next capability jump and give defenders time. It just cannot address models already released, foreign actors, or the large base of unpatched software, so it works only as one piece of a broader response.
How we source, write, and correct our articles. Editorial standards
